Manalyze report for 58fa8679eb278c0fbe4b9348e61cd274234037af160878289a988260eaf6246e

This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2073-Feb-26 10:07:54
Debug artifacts	C:\Users\j0k3r\Downloads\Compressed\Crypto CLipper\Clipper\obj\Release\Clipper.pdb
Comments
CompanyName
FileDescription	Host Process for Windows Services
FileVersion	`1.0.0.0`
InternalName	svchost.exe
LegalCopyright
LegalTrademarks
OriginalFilename	svchost.exe
ProductName	svchost
ProductVersion	`1.0.0.0`
Assembly Version	1.0.0.0

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C# v7.0 / Basic .NET`
Malicious	VirusTotal score: 55/70 (Scanned on 2024-04-08 13:21:36)	`ALYac: IL:Trojan.MSILZilla.14161` `AVG: Win32:BankerX-gen [Trj]` `AhnLab-V3: Malware/Win32.RL_Generic.C4147215` `Alibaba: TrojanBanker:MSIL/ClipBanker.93d899a7` `Arcabit: IL:Trojan.MSILZilla.D3751` `Avast: Win32:BankerX-gen [Trj]` `Avira: TR/YAV.Minerva.zbyba` `BitDefender: IL:Trojan.MSILZilla.14161` `BitDefenderTheta: Gen:NN.ZemsilF.36802.am0@aqDwjpd` `Bkav: W32.AIDetectMalware.CS` `CAT-QuickHeal: Trojan.YakbeexMSIL.ZZ4` `ClamAV: Win.Packed.Clipbanker-9949487-0` `CrowdStrike: win/malicious_confidence_100% (W)` `Cylance: unsafe` `DeepInstinct: MALICIOUS` `DrWeb: Trojan.ClipBankerNET.27` `ESET-NOD32: a variant of MSIL/ClipBanker.PW` `Elastic: malicious (high confidence)` `Emsisoft: IL:Trojan.MSILZilla.14161 (B)` `F-Secure: Trojan.TR/YAV.Minerva.zbyba` `FireEye: Generic.mg.f83c1904404d2b40` `Fortinet: MSIL/ClipBanker.PW!tr` `GData: IL:Trojan.MSILZilla.14161` `Google: Detected` `Gridinsoft: Trojan.Win32.Gen.sd!n` `Ikarus: Trojan.MSIL.ClipBanker` `Jiangmin: Trojan.Banker.MSIL.hpn` `K7AntiVirus: Trojan ( 00517fbc1 )` `K7GW: Trojan ( 00517fbc1 )` `Kaspersky: HEUR:Trojan-Banker.MSIL.ClipBanker.gen` `Kingsoft: MSIL.Trojan-Banker.ClipBanker.gen` `Lionic: Trojan.Win32.ClipBanker.Z!c` `MAX: malware (ai score=100)` `Malwarebytes: Malware.AI.3361548761` `MaxSecure: Trojan.Malware.73489558.susgen` `McAfee: GenericRXVK-YB!F83C1904404D` `MicroWorld-eScan: IL:Trojan.MSILZilla.14161` `Microsoft: Trojan:MSIL/ClipBanker.AI!MTB` `NANO-Antivirus: Trojan.Win32.YAV.katipc` `Panda: Trj/Chgt.AD` `Rising: Spyware.ClipBanker!1.D05B (CLASSIC)` `Sangfor: Trojan.Win32.Save.a` `SentinelOne: Static AI - Malicious PE` `Skyhigh: GenericRXVK-YB!F83C1904404D` `Sophos: Mal/ClipBank-A` `Symantec: ML.Attribute.HighConfidence` `Tencent: Malware.Win32.Gencirc.13ef84f9` `TrendMicro: TROJ_GEN.R002C0DIE23` `TrendMicro-HouseCall: TROJ_GEN.R002C0DIE23` `VBA32: TScope.Trojan.MSIL` `Varist: W32/Trojan.HJT.gen!Eldorado` `Yandex: Trojan.ClipBanker!UpJY1jWK1KU` `Zillya: Trojan.ClipBanker.Win32.20042` `ZoneAlarm: HEUR:Trojan-Banker.MSIL.ClipBanker.gen` `alibabacloud: HackTool:Win/SuperClipper.BZ`

Hashes

MD5	`f83c1904404d2b40622d28a5c05420f9`
SHA1	`87c629c25b2be94ff603fd4b5e1934541006cc44`
SHA256	`58fa8679eb278c0fbe4b9348e61cd274234037af160878289a988260eaf6246e`
SHA3	`94bd357266eae09945891c2d4af033cd4bf564b0d63c333bf7cf346605b35c88`
SSDeep	`192:/vnBrHsNjxAPGuPKm7gfsAq6/apEu74DFRO9e:/vnBrMw+uPK/Pq6/876y9`
Imports Hash	`f34d5f2d4577ed6d9ceec516c1f5a744`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x80`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`3`
TimeDateStamp	2073-Feb-26 10:07:54
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`48.0`
SizeOfCode	`0x1c00`
SizeOfInitializedData	`0x800`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00003A76 (Section: .text)`
BaseOfCode	`0x2000`
BaseOfData	`0x4000`
ImageBase	`0x400000`
SectionAlignment	`0x2000`
FileAlignment	`0x200`
OperatingSystemVersion	`4.0`
ImageVersion	`0.0`
SubsystemVersion	`6.0`
Win32VersionValue	`0`
SizeOfImage	`0x8000`
SizeOfHeaders	`0x200`
Checksum	`0xdebf`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NO_SEH` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`93ae0ca525316410545df2840e7214b0`
SHA1	`87431c6454181f05f2523fc6dcdeec0a69ec2a3d`
SHA256	`8db68d5adba7332f88ce36f0253440fd9600af92a409b44265b52106de30270b`
SHA3	`272f7e94fafe0c44ac9e90ff1f44254d986983359e2d934c39c39f8e9a4cddc1`
VirtualSize	`0x1a7c`
VirtualAddress	`0x2000`
SizeOfRawData	`0x1c00`
PointerToRawData	`0x200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.17582`

.rsrc

MD5	`3d8a81227ccbc88378577817e9231ea8`
SHA1	`c013748440b9d39d32c372be8e833f213de8c7d3`
SHA256	`2ec460a3a68d21e701a8d97ca5181878335503dcd42a24533bfb6ecb41812eac`
SHA3	`1bf3e1c16e2d5c6a0a375109519512f49a03f9f2679fd0017322a8f1decd219b`
VirtualSize	`0x5aa`
VirtualAddress	`0x4000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`4.03638`

.reloc

MD5	`9205b88a1c48ef5c159c44a073cd589d`
SHA1	`effef710a190a67e7e06664e529c447ea11411d7`
SHA256	`7fa76d243a33df8ea90f6c142dffefc113c5a1947e5768a6a6ef46b99a7f3300`
SHA3	`b335b7d020d949492cfae19fc7c8a4b796e1030835043b3f15fe77e983055c74`
VirtualSize	`0xc`
VirtualAddress	`0x6000`
SizeOfRawData	`0x200`
PointerToRawData	`0x2400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`0.0815394`

Imports

mscoree.dll	`_CorExeMain`

Delayed Imports

1

Type	`RT_VERSION`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x320`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.24018`
MD5	`29d1ac3d2f2cbbc276bc608aa289d002`
SHA1	`5122a65b647d1a90f59f5258a6a8cbd43f4b249c`
SHA256	`6efc671537505256d1d2c25eb417a60b6f0516f2f9517ef64805c6cf0614662b`
SHA3	`a42f112c7024edb4abf2bee3a55632f6bfc09f8f03a0bdb764ca1d3b60854f4f`

1 (#2)

Type	`RT_MANIFEST`
Language	UNKNOWN
Codepage	UNKNOWN
Size	`0x1ea`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.00112`
MD5	`b7db84991f23a680df8e95af8946f9c9`
SHA1	`cac699787884fb993ced8d7dc47b7c522c7bc734`
SHA256	`539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a`
SHA3	`4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	1.0.0.0
ProductVersion	1.0.0.0
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT_WINDOWS32` `VOS__WINDOWS32`
FileType	`VFT_APP`
Language	UNKNOWN
Comments
CompanyName
FileDescription	Host Process for Windows Services
FileVersion (#2)	1.0.0.0
InternalName	svchost.exe
LegalCopyright
LegalTrademarks
OriginalFilename	svchost.exe
ProductName	svchost
ProductVersion (#2)	1.0.0.0
Assembly Version	1.0.0.0

Resource LangID	UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2103-May-28 13:19:20
Version	`0.0`
SizeofData	`107`
AddressOfRawData	`0x39b8`
PointerToRawData	`0x1bb8`
Referenced File	C:\Users\j0k3r\Downloads\Compressed\Crypto CLipper\Clipper\obj\Release\Clipper.pdb

UNKNOWN

Characteristics	`0`
TimeDateStamp	1970-Jan-01 00:00:00
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.